AI Coding Agent Skills Bypass SCA and SAST Security Scanners
Research reveals that malicious instructions in AI agent skills evade static code analysis, creating blind spots for credential theft and data exfiltration in development workflows.
Key points
- Testing showed evasion techniques bypassed eight scanners in over 90% of cases.
- Malicious assets include SKILL.md files, plugins, and APM manifests.
- Threats involve prompt injection, hidden text, and credential exfiltration.
JFrog research published in July 2026 demonstrates that standard application security tools fail to detect malicious instructions embedded in AI coding agent assets. Developers who install agent skills, plugins, or Agent Package Manager manifests expose their environments to risks that static code analysis and software composition analysis cannot identify. These assets contain intent and instructions rather than traditional compiled code, allowing threats to slip through existing security pipelines undetected.
Root cause
Traditional security scanners look for known vulnerabilities in third-party libraries or flaws in source code logic. AI assets like SKILL.md files operate differently, carrying instructions that guide an agent’s behavior. Because these files are valid Markdown and lack a standard dependency tree or executable code path, SCA tools have nothing to resolve, and SAST tools have no code to trace. This structural difference creates a significant blind spot where malicious intent remains invisible to conventional AppSec methods.
Attack path
Researchers built an evasion framework that rewrote suspicious tokens and commands within malicious skills, hiding the payload until execution. Testing against 1,613 known malicious skills showed that the strongest evasion technique bypassed eight different scanners more than 90% of the time. Once installed, these cloaked skills functioned correctly in production agents, including Claude Code and Codex. The agents executed tasks without performance loss while simultaneously performing malicious actions like credential theft and source code exfiltration.
Affected versions
- Agent skills packaged as SKILL.md files with accompanying scripts.
- Agent plugins distributed through coding agent marketplaces.
- Agent Package Manager (APM) manifests bundling skills and prompts.
Mitigation
- Implement specialized scanning that analyzes agent intent and instructions, not just code.
- Review SKILL.md and manifest files manually before adding them to agent contexts.
- Isolate agents from sensitive credentials until trust is verified.
- Monitor for unexpected data exfiltration or command execution patterns.
Signals worth monitoring
Security teams should inspect agent logs for unusual file access patterns, particularly reads of credential stores or configuration files that do not align with the stated task. Monitor network traffic for outbound connections originating from coding agents that deviate from standard API calls. Look for discrepancies between the agent’s reported task success and the actual data handled. Teams typically contain such incidents by revoking agent access tokens and isolating the affected development environments immediately upon detection of anomalous behavior.
What to do and how to stay safe: JFrog
- Audit all installed agent skills and plugins for hidden instructions or obfuscated text blocks.
- Restrict agent permissions to prevent access to sensitive files like AWS credentials.
- Deploy scanning solutions that specifically analyze the intent and prompts within AI assets.
- Verify that your security pipeline covers APM manifests and SKILL.md files, not just source code.
Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views
General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why do standard scanners miss these AI assets?
Traditional tools analyze code paths and dependencies, but AI assets like SKILL.md files contain instructions and intent in valid Markdown that lacks executable code for static analysis.
What types of threats are found in these skills?
The research identified prompt injection, hidden instructions, obfuscated payloads, and credential exfiltration as primary threat classes within malicious AI assets.
Is there a CVE for these vulnerabilities?
No CVE exists because the instructions are classified as valid Markdown, making them a configuration and intent issue rather than a software vulnerability.
